Cite OWASP ASVS as the checklist your team builds and tests against, give the version (5.0.0, dated May 2025), and name the scope you actually verified. ASVS is a requirements standard, not a certificate, so say "we verify against" and show your results, never "ASVS certified".
What ASVS is
The OWASP Application Security Verification Standard describes itself as a basis for testing web application technical security controls and as a list of requirements that gives developers guidance for secure development. The project page states the latest stable version is 5.0.0, dated May 2025, while the master branch holds in-progress work.
This answers a common questionnaire line: "What secure coding standard or framework do you follow?" Many teams reply with "OWASP Top 10", which is an awareness list. ASVS gives you numbered requirements you can test.
Reference requirements the right way
OWASP asks that requirements be cited with version, chapter, section and requirement number, in the form v5.0.0-1.2.5. The page warns against bare identifiers because numbering can change between versions. Follow that, so a reviewer can look up exactly what you mean.
How a small team can use it
You do not need to verify every requirement on day one. A workable path:
- Choose the chapters that match your product, such as authentication, session management, access control and validation.
- Record each requirement as met, partly met, not applicable or not met, with a note and a link to evidence.
- Turn gaps into tickets with owners.
- Re-run the review when you ship a major feature.
- Keep the sheet in version control so history is visible.
The ASVS project distributes the requirements in several formats, including a spreadsheet style CSV, which suits this tracking. Check which level your buyers expect. I could not confirm the level definitions from the project page I fetched, so read the standard itself before you state one.
Wording options
| Situation | Honest wording |
|---|---|
| You track requirements in a sheet | We assess our web application against selected chapters of OWASP ASVS 5.0.0 and track gaps |
| You also test with a third party | An independent tester used ASVS as the basis for scope. Report available under NDA |
| You only know the Top 10 | We follow OWASP Top 10 awareness training. We are adopting ASVS for requirements |
Never imply that a tool scan alone proves ASVS conformance. Automated tools cover only part of what the standard asks, and several requirements need design review or manual testing.
Try it yourself
Click through it at your own pace, or open it full screen. Notice which kinds of findings a scan produces, and think about which ASVS requirements still need a person to check.
Safeguard supports SBOM and dependency scanning, plus policies and gates to enforce checks on pull requests. The free scan is a quick way to see the dependency side.
Quick check
Is ASVS a certification?
No. It is a verification standard and requirements list. Say you verify against it.
How do I cite a requirement?
Use the version-chapter.section.requirement format, for example v5.0.0-1.2.5, as OWASP recommends.
Sources
- OWASP, Application Security Verification Standard project page: description, version 5.0.0, citation format. Paraphrased.
- OWASP, ASVS repository README: version 5.0.0 dated May 2025. Paraphrased.
Last reviewed: 19 October 2026.
